Getting CERTIFICATE_VERIFY_FAILED error

[Carsten Wolfram]

Hi there,

whenever I use GAM, I get the following error message:

Error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)

It just turned up out of the blue. For example, setting a default sendas alias always returns this error.

Update: It does NOT show when I enter "gam info user …", this command does what it should. 

Does anyone know what's wrong here?

[Jeremiah Cherwien]

Greetings Carsten - Did you ever resolve this?  My automation install of GAM is starting to show this as well, mostly when dealing with audit keys and mailbox exports - Group and account updates seem to work normally atm.

Miah

[Walter Moore]

Miah, what version of python are you using? There's a problem with certificate handling generally starting v2.7.9. The only solution I found immediately was to backrev to an earlier version of 2.7.

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/b15e83b0-9b01-43cb-8784-825ac2db6101%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

+-----------------------------------------------------------------+
Walter R. Moore --  Sr. Systems Administrator, Eckerd College
moo...@eckerd.edu --  http://home.eckerd.edu/~moorewr

"It was glorious to see -- if your heart were iron,
And you could keep from grieving at all the pain" - The Iliad (13.355)

I'm on twitter: http://twitter.com/moorewreckerd

***Reminder! ITS will never ask you to e-mail your password!***

[Jeremiah Cherwien]

Thanks for the reply - I don't believe Python is installed on this box - It's utilizing the Windows x64 version of GAM.

--
You received this message because you are subscribed to a topic in the Google Groups "Google Apps Manager" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/EI2VvMBtv48/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAK6HWAuZ3USOsb3AEXv_A50enJ6gQqH4JfODLju2TcutOh3Mjg%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Jeremiah L. Cherwien
Interim Director of Technology
Office of Technology
Luther Seminary
2481 Como Ave.
St. Paul, MN 55108
Ph:  651-641-3512

"Quis Custodiet Ipsos Custodes"

[Robert Bagnall]

I just saw it too. Win x64 also.

Not on info request but when trying to set up delegate (I guess that is a similar access to setting up "sendas" as in the original post while info requests use a different API or lower access level ?). I upgraded to v3.5 last week - this is probably the first time I did a delegate access since then.

Although Windows .exe doesn't use a python install on my machine it clearly must have been built with one so maybe that python got updated to 2.7.9+ and thus the error got brought in to the latest gam.exe ?

Rob.

[Robert Bagnall]

Downloaded v3.51 - issue persists.

Downloaded v3.51 source and ran the same command (show delegates) using the Python v2.7.4 installed on my machine and the command executes cleanly.

As suspected, code is not at fault - it's the building of the gam.exe that is causing the issue.


Rob.

[Jay Lee]

I haven't been able to reproduce this issue. What version of Windows are you running? Is the cacert.pem file in your GAM folder?

--

You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/a50be8b7-3f96-4231-bb43-a2d9779fa9ec%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Jay Lee

[T Roche]

+1 

I just upgraded my version of Debian, python and GAM and now get this error too.

GAM 3.51 - http://git.io/gam

Python 2.7.9 64-bit final

google-api-python-client 1.4.1

Linux-2.6.32-5-amd64-x86_64-with-debian-6.0.10 x86_64

[Jay Lee]

T Roche,

  Can you post the full error message you are seeing and the command you are running? Is your GAM install sitting behind a proxy/firewall that does SSL inspection?

Jay 

Tá an teachtaireacht seo scanta ó thaobh ábhar agus víreas ag Seirbhís Scanta Ríomhphost de chuid Seirbhísí Faisnéise, ITBÁC agus meastar í a bheith slán.http://www.dit.ie 

This message has been scanned for content and viruses by the DIT Information Services E-Mail Scanning Service, and is believed to be clean. http://www.dit.ie 

This email originated from DIT. If you received this email in error, please delete it from your system. Please note that if you are not the named addressee, disclosing, copying, distributing or taking any action based on the contents of this email or attachments is prohibited. www.dit.ie

Is ó ITBÁC a tháinig an ríomhphost seo. Má fuair tú an ríomhphost seo trí earráid, scrios de do chóras é le do thoil. Tabhair ar aird, mura tú an seolaí ainmnithe, go bhfuil dianchosc ar aon nochtadh, aon chóipeáil, aon dáileadh nó ar aon ghníomh a dhéanfar bunaithe ar an ábhar atá sa ríomhphost nó sna hiatáin seo. www.dit.ie

Tá ITBÁC ag aistriú go Gráinseach Ghormáin – DIT is on the move to Grangegorman

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/54254852-94d1-4705-8189-20332ff2a6c9%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Jay Lee

[T Roche]

# gam print resources

Retrieving All Resource Calendars for your account (may take some time on a large domain)

Error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)

(debug.gam exists).

No proxy, through a firewall but not sure if it is doing SSL inspection.

[Jay Lee]

Try creating a file called noverifyssl.txt in the same folder as gam.py and see if that resolves. Be aware though that this exposes you to a large security risk of man in the middle attacks.

Jay

Tá an teachtaireacht seo scanta ó thaobh ábhar agus víreas ag Seirbhís Scanta Ríomhphost de chuid Seirbhísí Faisnéise, ITBÁC agus meastar í a bheith slán.http://www.dit.ie 

This message has been scanned for content and viruses by the DIT Information Services E-Mail Scanning Service, and is believed to be clean. http://www.dit.ie 

This email originated from DIT. If you received this email in error, please delete it from your system. Please note that if you are not the named addressee, disclosing, copying, distributing or taking any action based on the contents of this email or attachments is prohibited. www.dit.ie

Is ó ITBÁC a tháinig an ríomhphost seo. Má fuair tú an ríomhphost seo trí earráid, scrios de do chóras é le do thoil. Tabhair ar aird, mura tú an seolaí ainmnithe, go bhfuil dianchosc ar aon nochtadh, aon chóipeáil, aon dáileadh nó ar aon ghníomh a dhéanfar bunaithe ar an ábhar atá sa ríomhphost nó sna hiatáin seo. www.dit.ie

Tá ITBÁC ag aistriú go Gráinseach Ghormáin – DIT is on the move to Grangegorman

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/ff2c0706-aaae-478e-854c-aa44e34a9f79%40googlegroups.com.

[T Roche]

Created file noverifyssl.txt but same error I'm afraid.

[Jay Lee]

Can you try using a different internet connection that is direct? Maybe tether to your phone? I suspect this is due to your firewall.

Jay

On Jul 15, 2015 7:16 AM, "T Roche" <025...@dit.ie> wrote:

Created file noverifyssl.txt but same error I'm afraid.

Tá an teachtaireacht seo scanta ó thaobh ábhar agus víreas ag Seirbhís Scanta Ríomhphost de chuid Seirbhísí Faisnéise, ITBÁC agus meastar í a bheith slán.http://www.dit.ie 

This message has been scanned for content and viruses by the DIT Information Services E-Mail Scanning Service, and is believed to be clean. http://www.dit.ie 

This email originated from DIT. If you received this email in error, please delete it from your system. Please note that if you are not the named addressee, disclosing, copying, distributing or taking any action based on the contents of this email or attachments is prohibited. www.dit.ie

Is ó ITBÁC a tháinig an ríomhphost seo. Má fuair tú an ríomhphost seo trí earráid, scrios de do chóras é le do thoil. Tabhair ar aird, mura tú an seolaí ainmnithe, go bhfuil dianchosc ar aon nochtadh, aon chóipeáil, aon dáileadh nó ar aon ghníomh a dhéanfar bunaithe ar an ábhar atá sa ríomhphost nó sna hiatáin seo. www.dit.ie

Tá ITBÁC ag aistriú go Gráinseach Ghormáin – DIT is on the move to Grangegorman

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/aadc5e81-7662-42cb-aa81-d165d7bb75d9%40googlegroups.com.

[Robert Bagnall]

I'm running on Win7SP1 64bit.
cacert.pem is in place.
Creating the noverifyssl.txt file made no difference.

As I noted in my first post (and I apologise for not keeping the reference) this appears to be due to python 2.7.9. So...

@T Roche - that would explain why you now get the error as you are now on that version of Python

@Jay Lee - how is gam.exe built (I read that you changed the method but I think it's the python version in that "compiler" that is the issue). As I said, if I use the source version and run on my machine with an older python I don't get the error, only get it with gam.exe 3.5x. I still have 3.43 on my system - confirmed that still works fine (gam.exe).

Rob.

[Jay Lee]

GAM Windows executables are built using pyinstaller.

I'm betting that if you upgrade your Windows install of Python to 2.7.10 you'll see the same issue with the source version. I don't think this is pyinstaller related.

Try using a different, direct Internet connection.

Jay

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/8467590f-3236-4e41-add5-d6ed88af3323%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Jay Lee

[T Roche]

Just confirming all works with GAM 3.51 and an older version of python (2.6) - no error.

GAM 3.51 - http://git.io/gam

Python 2.6.9 64-bit final

google-api-python-client 1.4.1

Linux-2.6.32-5-amd64-x86_64-with-debian-6.0.10 x86_64

[Robert Bagnall]

Yes, that's the point. It's a python version issue so gam.exe is breeding affected due to pyinstaller. TR by his OS upgrade and I would be if I upgraded python on my box.

I realise you can't do much about python ...is there a pyinstaller with an earlier python built in ?

Can you pot since advice on the die about the python version issue ?

Rob.

[T Roche]

Found this page https://www.python.org/dev/peps/pep-0476/ and tried out the (highly discouraged) opting out patch out of interest.  It worked, and GAM 3.51 worked with python 2.7.9 with no error.

[Jay Lee]

As far as I can see, this isn't a bug with Python 2.7.9+, it's a bug that was FIXED in Python 2.7.9+. GAM is not getting Google SSL certificates when it connects to these APIs which is a serious security issue.

Can you guys please test on another Internet connection and report if the issue persists?

Jay

--

You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/CAHqoLN3QAPtRjAqLS-cfonrAn9nLbS75epuSUeowJ1OayObXxg%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Jay Lee

[Jay Lee]

If you run:

curl -vv https://apps-apis.google.com/

on your debian box, what output do you see (paste the whole thing).

Jay

On Wed, Jul 15, 2015 at 11:30 AM T Roche <025...@dit.ie> wrote:

Found this page https://www.python.org/dev/peps/pep-0476/ and tried out the (highly discouraged) opting out patch out of interest.  It worked, and GAM 3.51 worked with python 2.7.9 with no error.

Tá an teachtaireacht seo scanta ó thaobh ábhar agus víreas ag Seirbhís Scanta Ríomhphost de chuid Seirbhísí Faisnéise, ITBÁC agus meastar í a bheith slán.http://www.dit.ie 

This message has been scanned for content and viruses by the DIT Information Services E-Mail Scanning Service, and is believed to be clean. http://www.dit.ie 

This email originated from DIT. If you received this email in error, please delete it from your system. Please note that if you are not the named addressee, disclosing, copying, distributing or taking any action based on the contents of this email or attachments is prohibited. www.dit.ie

Is ó ITBÁC a tháinig an ríomhphost seo. Má fuair tú an ríomhphost seo trí earráid, scrios de do chóras é le do thoil. Tabhair ar aird, mura tú an seolaí ainmnithe, go bhfuil dianchosc ar aon nochtadh, aon chóipeáil, aon dáileadh nó ar aon ghníomh a dhéanfar bunaithe ar an ábhar atá sa ríomhphost nó sna hiatáin seo. www.dit.ie

Tá ITBÁC ag aistriú go Gráinseach Ghormáin – DIT is on the move to Grangegorman

--
You received this message because you are subscribed to the Google Groups "Google Apps Manager" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/be9f0d56-bf03-4fae-afb0-d561bf364a34%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Jay Lee

[Vojta Myslivec]

Hello Jay and thanks for your constructive reply. I have the same issue and I have tried your command.

curl is reporting "(60) SSL certificate problem: unable to get local issuer certificate"


I have discovered that https://apps-apis.google.com/ is using "CN=*.google.com" certificate which is issued by "CN=Google Internet Authority G2", a Google's CA, which is issued by root CA "CN=GeoTrust Global CA".

I have GeoTrust Global CA properly installed (via ca-certificates package) in /etc/ssl/certs/ system folder.



Is it possible that the curl/gam/python is not checking whole certificate chain but only the first issuer? I am not able to install Google Internet Authority G2 CA in system directory via dpkg-recofigure ca-certificates command (and I do not want to).

Or where should be the problem? Does Google use some other root CA certificates?

[T Roche]

Don't see my previous response in the thread so posting output (whole thing) again FYI:

#curl -vv https://apps-apis.google.com/

* Hostname was NOT found in DNS cache

*   Trying 74.125.24.118...

* Connected to apps-apis.google.com (74.125.24.118) port 443 (#0)

* successfully set certificate verify locations:

*   CAfile: none

  CApath: /etc/ssl/certs

* SSLv3, TLS handshake, Client hello (1):

* SSLv3, TLS handshake, Server hello (2):

* SSLv3, TLS handshake, CERT (11):

* SSLv3, TLS alert, Server hello (2):

* SSL certificate problem: unable to get local issuer certificate

* Closing connection 0

curl: (60) SSL certificate problem: unable to get local issuer certificate

More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"

 of Certificate Authority (CA) public keys (CA certs). If the default

 bundle file isn't adequate, you can specify an alternate file

 using the --cacert option.

If this HTTPS server uses a certificate signed by a CA represented in

 the bundle, the certificate verification probably failed due to a

 problem with the certificate (it might be expired, or the name might

 not match the domain name in the URL).

If you'd like to turn off curl's verification of the certificate, use

 the -k (or --insecure) option.

On Wednesday, 15 July 2015 16:56:47 UTC+1, Jay Lee wrote:

If you run:

curl -vv https://apps-apis.google.com/

on your debian box, what output do you see (paste the whole thing).

Jay

On Wed, Jul 15, 2015 at 11:30 AM T Roche <025...@dit.ie> wrote:

Found this page https://www.python.org/dev/peps/pep-0476/ and tried out the (highly discouraged) opting out patch out of interest.  It worked, and GAM 3.51 worked with python 2.7.9 with no error.

Jay Lee

[Andrew Rowland]

Bump - Did we find a fix to this? Running Win 10 x64. Running GAMx64. When I run this command I get the error: gam audit monitor

On Wednesday, April 8, 2015 at 8:22:19 AM UTC-5, Carsten Wolfram wrote:

[Richard van Delft]

Andrew, same config over here win10, x64, gamx64. same problem. is this Google or windows? Any thoughts on solving this?

---

Disclaimer: This email and any files transmitted with it, are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify G-workplace and destroy this message. G-workplace B.V. has it registered offices in The Hague, The Netherlands and is registered with the Chamber of Commerce under no. 52204316.

---

[Massimo Gorla]

I found an easy workaround for Windows 7 and GAM 64 bit binaries. Can't say anything about the others.

Use GAM 3.45 https://github.com/jay0lee/GAM/releases/tag/v3.45

[Andrew Rowland]

3.51 worked fine on Windows 7, but when I went to Windows 10 I have issues. 

--
You received this message because you are subscribed to a topic in the Google Groups "Google Apps Manager" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/google-apps-manager/EI2VvMBtv48/unsubscribe.
To unsubscribe from this group and all its topics, send an email to google-apps-man...@googlegroups.com.

To post to this group, send email to google-ap...@googlegroups.com.
Visit this group at http://groups.google.com/group/google-apps-manager.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/eaf23f00-b6e8-4aa6-a2e8-80271562a934%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Andrew Rowland

Associate Director of IT

1400 Camp St. New Orleans, LA 70130

c 504-377-7614

www.isl-edu.org

-------------------------------------------------------

Facebook: /InternationalSchoolofLouisiana

Twitter: @ISLnola

Pinterest: /ISLnola

​

Confidentiality Notice: The contents of this email and its attachments are intended solely for the addressee(s).  In addition, this email transmission may be confidential and may be subject to privilege, not limited to but including, protecting private student identification information pursuant to F.E.R.P.A.  The information contained in this electronic message is PRIVILEGED and confidential information intended only for the use of the individual entity or entities named as recipient or recipients. If the reader is not the intended recipient, be hereby notified that any dissemination, distribution or copy of this communication is strictly prohibited. If you have received this communication in error, please notify me immediately by electronic mail or by telephone and permanently delete this message from your computer system. Thank you.

[Gregory Dudek]

This is a very ugly hack workaround, but I briefly circumvented SSL certificate auth by editing site-packages/requests/sessions.py

and set 

   self.verify = False (right after "SSL Verification default")

BTW I am using python 3.4.2

[Ross Scroggs]

Gregory,

If you're having SSL verification issues, you can turn off Gam SSL verification by creating an empty file named noverifyssl.txt in the same folder as gam.

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for G Suite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-manager+unsub...@googlegroups.com.
To post to this group, send email to google-apps-manager@googlegroups.com.
Visit this group at https://groups.google.com/group/google-apps-manager.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/cdb2da57-d74f-40d9-92b1-0f5b3d5709d3%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Ross Scroggs

ross.s...@gmail.com